@devmoods/express-extras 0.52.3 → 0.53.0

package/dist/auth/passwordless.d.ts

@@ -1,6 +1,6 @@
 import { type AnyUser, type AuthProvider } from './types.js';
 export interface PasswordlessAuthProviderOptions<UserModel = AnyUser> {
     getUserByEmail(email: string): Promise<UserModel | null>;
-    onLoginRequest(user: UserModel, temporaryToken: string): Promise<void>;
+    onLoginRequest(user: UserModel, temporaryToken: string, otp: string): Promise<void>;
 }
 export declare function PasswordlessAuthProvider<UserModel extends AnyUser>(options: PasswordlessAuthProviderOptions<UserModel>): AuthProvider<UserModel>;

package/dist/auth/passwordless.js

@@ -1,6 +1,5 @@
 import { createTokenResponse } from './token.js';
 import {} from './types.js';
-import { Unauthorized } from '../errors.js';
 import { getLogger } from '../logger.js';
 import { route } from '../middleware.js';
 import { DoesNotExistError } from '../postgres.js';
@@ -20,19 +19,25 @@ export function PasswordlessAuthProvider(options) {
     };
     return {
         setupRoutes(router, context) {
-            router.post('/passwordless/login/:token', route(async (req, res) => {
-                const { token: temporaryToken } = req.params;
-                const decoded = context.decodeTemporaryToken(temporaryToken);
-                const user = await context.getUserById(decoded.payload.uid);
-                try {
-                    await context.verifyTemporaryToken(temporaryToken, user);
-                }
-                catch {
-                    logger.warn('passwordless: invalid temp token', { uid: user.id });
-                    throw Unauthorized('Invalid token');
-                }
+            router.post('/passwordless/login', validateBody({
+                type: 'object',
+                properties: {
+                    type: { type: 'string', enum: ['otp', 'token'] },
+                    otp: { type: 'string' },
+                    token: { type: 'string' },
+                },
+                required: ['type'],
+            }), route(async (req, res) => {
+                const { token: temporaryToken, otp, type: tokenType } = req.body;
+                const verify = tokenType === 'otp'
+                    ? context.verifyOtp
+                    : context.verifyTemporaryToken;
+                const tokenValue = tokenType === 'otp' ? otp : temporaryToken;
+                const uid = await verify(tokenValue, null, false);
+                const user = await context.getUserById(uid);
+                await verify(tokenValue, user);
                 const accessToken = await context.login(req, res, user);
-                logger.info('passwordless login', { uid: user.id });
+                logger.info('passwordless login', { tokenType, uid: user.id });
                 if (req.accepts('html')) {
                     return res.redirect('/');
                 }
@@ -55,7 +60,8 @@ export function PasswordlessAuthProvider(options) {
                     return 202;
                 }
                 const token = await context.createTemporaryToken(user);
-                await options.onLoginRequest(user, token);
+                const otp = await context.createOtp(user);
+                await options.onLoginRequest(user, token, otp);
                 logger.info('passwordless login requested', { email });
                 return 202;
             }));

package/dist/auth/types.d.ts

@@ -35,8 +35,10 @@ export interface AuthProviderContext<UserModel extends AnyUser> {
     tokenStorage: AuthOptions<UserModel>['tokenStorage'];
     setCurrentUser: (user: UserModel) => void;
     createTemporaryToken(user: UserModel): Promise<string>;
-    verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
+    verifyTemporaryToken(token: string, user: UserModel | null, consume?: boolean): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
+    createOtp(user: UserModel): Promise<string>;
+    verifyOtp(otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     login: (req: Request, res: Response, user: UserModel, isRefresh?: boolean) => Promise<AccessToken>;
     getUserById(id: string): Promise<UserModel>;

package/dist/auth.d.ts

@@ -12,8 +12,10 @@ export interface CreateAuth<UserModel extends AnyUser> {
     before: () => RequestHandler;
     isAuthorized: (fn?: (user: UserModel) => boolean) => RequestHandler;
     createTemporaryToken(user: UserModel): Promise<string>;
-    verifyTemporaryToken(token: string, user: UserModel): Promise<void>;
+    verifyTemporaryToken(token: string, user: UserModel | null): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
+    createOtp(user: UserModel): Promise<string>;
+    verifyOtp(otp: string, user: UserModel | null): Promise<string>;
     logout: (req: Request, res: Response) => Promise<void>;
 }
 export declare class RedisTokenStorage extends TokenStorage {

package/dist/auth.js

@@ -71,6 +71,8 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         createTemporaryToken,
         verifyTemporaryToken,
         decodeTemporaryToken,
+        createOtp,
+        verifyOtp,
         middleware,
         login,
         getUserById,
@@ -185,6 +187,24 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             }
         };
     }
+    async function createOtp(user) {
+        const otp = crypto.randomInt(100000, 999999).toString();
+        await tokenStorage.set(otp, String(user.id), config.value.AUTH_OTP_EXPIRES_IN);
+        return otp;
+    }
+    async function verifyOtp(otp, user, consume = true) {
+        const storedUid = await tokenStorage.get(otp);
+        if (!storedUid) {
+            throw new InvalidToken('Invalid OTP');
+        }
+        if (user && storedUid !== user.id) {
+            throw new InvalidToken('Invalid OTP');
+        }
+        if (consume) {
+            await tokenStorage.invalidate(otp);
+        }
+        return storedUid;
+    }
     /**
      * Create a short-lived token tied to a user that can be
      * used for different kinds of verification.
@@ -213,7 +233,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
     function decodeTemporaryToken(token) {
         return JSON.parse(Buffer.from(token, 'base64url').toString('utf-8'));
     }
-    async function verifyTemporaryToken(token, user) {
+    async function verifyTemporaryToken(token, user, consume = true) {
         const decoded = decodeTemporaryToken(token);
         const expectedSignature = crypto
             .createHmac('sha256', config.value.AUTH_SECRET)
@@ -223,14 +243,20 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         if (expectedSignature !== decoded.signature) {
             throw new InvalidToken('Invalid signature');
         }
-        if (decoded.payload.uid !== user.id) {
+        if (user && decoded.payload.uid !== user.id) {
             throw new InvalidToken(`Invalid user ${user.id}`);
         }
         const storedUid = await tokenStorage.get(token);
-        if (storedUid !== user.id) {
+        if (!storedUid) {
+            throw new InvalidToken('Invalid token not found');
+        }
+        if (user && storedUid !== user.id) {
             throw new InvalidToken(`Invalid user ${user.id}`);
         }
-        await tokenStorage.invalidate(token);
+        if (consume) {
+            await tokenStorage.invalidate(token);
+        }
+        return storedUid;
     }
     return {
         before: () => middleware(false),
@@ -241,6 +267,8 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         createTemporaryToken,
         verifyTemporaryToken,
         decodeTemporaryToken,
+        createOtp,
+        verifyOtp,
         logout,
     };
 }

package/dist/config.d.ts

@@ -5,6 +5,7 @@ export declare const config: {
         PUBLIC_URL: string;
         AUTH_TOKEN_EXPIRES_IN: number;
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
+        AUTH_OTP_EXPIRES_IN: number;
         AUTH_SECRET: string;
         AUTH_COOKIE_SAME_SITE: string;
         REDIS_URL: string;
@@ -37,6 +38,7 @@ export declare function extendConfig<T extends Record<string, unknown>>(appConfi
         PUBLIC_URL: string;
         AUTH_TOKEN_EXPIRES_IN: number;
         AUTH_TEMP_TOKEN_EXPIRES_IN: number;
+        AUTH_OTP_EXPIRES_IN: number;
         AUTH_SECRET: string;
         AUTH_COOKIE_SAME_SITE: string;
         REDIS_URL: string;

package/dist/config.js

@@ -8,6 +8,7 @@ const baseConfig = {
     PUBLIC_URL: readEnv('PUBLIC_URL', ''),
     AUTH_TOKEN_EXPIRES_IN: readEnv.number('AUTH_TOKEN_EXPIRES', 3600 * 24 * 30), // 30 days
     AUTH_TEMP_TOKEN_EXPIRES_IN: readEnv.number('AUTH_TEMP_TOKEN_EXPIRES', 3600),
+    AUTH_OTP_EXPIRES_IN: readEnv.number('AUTH_OTP_EXPIRES', 5 * 60),
     AUTH_SECRET: readEnv('AUTH_JWT_SECRET', ''),
     AUTH_COOKIE_SAME_SITE: readEnv('AUTH_COOKIE_SAME_SITE', 'strict'),
     REDIS_URL: readEnv('REDIS_URL', ''),

package/dist/errors.js

@@ -2,6 +2,7 @@ import { STATUS_CODES } from 'node:http';
 import * as Sentry from '@sentry/node';
 import { errors } from 'compose-middleware';
 import {} from 'express';
+import { InvalidToken } from './auth/errors.js';
 import { getLogger } from './logger.js';
 import { DoesNotExistError, IntegrityError } from './postgres.js';
 export class ApiError extends Error {
@@ -48,6 +49,9 @@ function convertToAPIError(error) {
     if (error instanceof DoesNotExistError) {
         return NotFound(error.message);
     }
+    if (error instanceof InvalidToken) {
+        return Unauthorized(error.message);
+    }
     return error;
 }
 function _errorHandler({ onError }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devmoods/express-extras",
-  "version": "0.52.3",
+  "version": "0.53.0",
   "description": "Kubernetes-ready utilities for rapid Node.js application development",
   "type": "module",
   "main": "./dist/index.js",
@@ -46,31 +46,31 @@
   "devDependencies": {
     "@devmoods/eslint-config": "^2.6.0",
     "@types/koa-compose": "^3.2.8",
-    "@types/node": "22.13.4",
+    "@types/node": "22.13.5",
     "@types/supertest": "^6.0.2",
     "@vitejs/plugin-react": "^4.3.4",
-    "@vitest/coverage-v8": "^3.0.5",
-    "arktype": "^2.0.4",
+    "@vitest/coverage-v8": "^3.0.7",
+    "arktype": "^2.1.0",
     "cookiejar": "^2.1.4",
-    "eslint": "^9.20.1",
+    "eslint": "^9.21.0",
     "faktory-worker": "^4.6.0",
-    "prettier": "3.5.1",
+    "prettier": "3.5.2",
     "supertest": "7.0.0",
     "ts-node": "10.9.2",
-    "tsx": "^4.19.2",
+    "tsx": "^4.19.3",
     "typescript": "5.7.3",
-    "vite": "^6.1.0",
-    "vitest": "^3.0.5",
+    "vite": "^6.1.1",
+    "vitest": "^3.0.7",
     "vitest-fail-on-console": "^0.7.1"
   },
   "dependencies": {
     "@devmoods/fetch": "^4.0.1",
-    "@sentry/node": "^9.1.0",
-    "@sentry/profiling-node": "^9.1.0",
+    "@sentry/node": "^9.2.0",
+    "@sentry/profiling-node": "^9.2.0",
     "@types/bcrypt": "^5.0.2",
     "@types/cookie-parser": "^1.4.8",
     "@types/express": "^5.0.0",
-    "@types/jsonwebtoken": "^9.0.8",
+    "@types/jsonwebtoken": "^9.0.9",
     "@types/nodemailer": "^6.4.17",
     "@types/pg": "^8.11.11",
     "@types/superagent": "^8.1.9",
@@ -90,8 +90,8 @@
     "pg": "^8.13.3",
     "redis": "^4.7.0",
     "sonda": "^0.7.1",
-    "sql-formatter": "^15.4.10",
-    "uuid": "^11.0.5"
+    "sql-formatter": "^15.4.11",
+    "uuid": "^11.1.0"
   },
   "prettier": {
     "singleQuote": true